Principles of Information Security: Security Governance and Policies (ISO 27001, NIST CSF, COBIT)

Security Governance and Policies (ISO 27001, NIST CSF, COBIT)

Security Governance and Policies (ISO 27001, NIST CSF, COBIT) – Exam-Ready Study Guide

What This Is

Security governance and policies provide the framework, rules, and oversight needed to protect an organization’s information assets. Without them, even the best technical controls (firewalls, encryption) fail due to misalignment with business goals, compliance gaps, or human error.

Real-world example:
In 2020, Twitter suffered a high-profile breach where attackers socially engineered employees to gain access to internal admin tools, leading to the hijacking of high-profile accounts (e.g., Barack Obama, Elon Musk). The root cause? Weak governance—no multi-factor authentication (MFA) for admin tools, poor employee training, and unclear policies on access control. The attack cost Twitter $1.1M in fines and reputational damage.

Governance ensures policies are aligned with business objectives, compliant with laws (GDPR, HIPAA), and enforced consistently.

Key Terms & Concepts

• Governance (Security Governance):
  The oversight and decision-making process that ensures security aligns with business goals. Led by executives (CISO, Board) and supported by frameworks like ISO 27001, NIST CSF, COBIT.

• ISO 27001:
  An international standard for Information Security Management Systems (ISMS). Provides a risk-based approach to security, requiring policies, risk assessments, and continuous improvement (Plan-Do-Check-Act cycle).

• NIST Cybersecurity Framework (CSF):
  A voluntary U.S. framework (developed by NIST) with 5 core functions: Identify, Protect, Detect, Respond, Recover. Used by critical infrastructure (banks, healthcare) but applicable to any organization.

• COBIT (Control Objectives for Information and Related Technologies):
  A governance framework by ISACA that bridges IT and business goals. Focuses on aligning IT with business strategy, risk management, and compliance (e.g., SOX, GDPR).

• Policy vs. Standard vs. Procedure vs. Guideline:

• Policy: High-level management directives (e.g., "All employees must use MFA").
• Standard: Mandatory rules (e.g., "Passwords must be 12+ characters").
• Procedure: Step-by-step instructions (e.g., "How to reset a password").

• Guideline: Recommended best practices (e.g., "Use a password manager").

• Risk Management (NIST SP 800-37):
  The process of identifying, assessing, and mitigating risks to an acceptable level. Includes:

• Risk Assessment (identify threats/vulnerabilities).
• Risk Treatment (mitigate, transfer, accept, or avoid).

• Risk Monitoring (continuous review).

• Business Impact Analysis (BIA):
  A risk assessment method that identifies critical business functions and their maximum tolerable downtime (MTD). Helps prioritize recovery efforts (e.g., "Payroll must be restored within 4 hours").

• Data Classification:
  Labeling data based on sensitivity (e.g., Public, Internal, Confidential, Restricted). Ensures proper handling (e.g., encryption for "Restricted" data).

• Compliance vs. Security:

• Compliance: Meeting legal/regulatory requirements (e.g., GDPR, HIPAA).

• Security: Implementing controls to protect assets, which may go beyond compliance.
  ⚠️ Exam trap: Compliance ≠ Security (e.g., a company can be HIPAA-compliant but still have weak security).

• Security Awareness Training:
  Educating employees on security policies, phishing, and social engineering. Most breaches start with human error (e.g., clicking a malicious link).

• Third-Party Risk Management (TPRM):
  Assessing and monitoring vendors/suppliers for security risks (e.g., SolarWinds hack via a compromised software update).

• Incident Response Plan (IRP):
  A documented process for detecting, responding to, and recovering from security incidents (NIST SP 800-61).

Step-by-Step / Process Flow

How to Implement Security Governance (ISO 27001/NIST CSF Approach)

1. Establish Leadership & Scope
2. Get executive buy-in (CISO, Board).
3. Define scope (e.g., "All customer data in cloud environments").

4. Assign roles/responsibilities (RACI matrix: Responsible, Accountable, Consulted, Informed).

5. Conduct a Risk Assessment

6. Identify assets (data, systems, people).
7. Identify threats (e.g., ransomware, insider threats).
8. Identify vulnerabilities (e.g., unpatched software, weak passwords).
9. Assess risk (Likelihood × Impact = Risk Level).

10. Prioritize risks (e.g., "High: Unpatched VPN servers").

11. Develop Policies & Controls

12. Write security policies (e.g., Acceptable Use, Remote Work).
13. Select controls (ISO 27001 Annex A, NIST CSF subcategories).

14. Example controls:

    
    
    • Technical: Firewalls, encryption, MFA.
    • Administrative: Security awareness training, access reviews.
    • Physical: Badge access, CCTV.

15. Implement & Train

16. Deploy technical controls (e.g., SIEM, endpoint protection).
17. Train employees on policies (phishing simulations, policy acknowledgments).

18. Test controls (penetration testing, tabletop exercises).

19. Monitor & Improve (PDCA Cycle)

20. Plan: Set objectives (e.g., "Reduce phishing click rate by 50%").
21. Do: Implement controls.
22. Check: Audit logs, conduct vulnerability scans.

23. Act: Update policies based on findings (e.g., "Add MFA for all remote access").

24. Compliance & Certification (Optional)

25. ISO 27001 certification: Requires an external audit by a certified body.
26. NIST CSF: Self-assessed (no certification, but used for FedRAMP compliance).
27. COBIT: Used for IT governance audits (e.g., SOX compliance).

Common Mistakes

Certification Exam Tips

CISSP Tips

• Governance vs. Management:
• Governance = Strategic (Board, CISO, policies).
• Management = Tactical (implementing controls, day-to-day operations).

• ⚠️ Exam trap: "Who is responsible for governance?" → Board of Directors (not the CISO).

• ISO 27001 vs. NIST CSF:

• ISO 27001 = Certifiable standard (Plan-Do-Check-Act).
• NIST CSF = Voluntary framework (Identify-Protect-Detect-Respond-Recover).

• COBIT = IT governance (aligns IT with business goals).

• Risk Management Questions:

• Qualitative vs. Quantitative Risk Assessment:
  • Qualitative: Subjective (Low/Medium/High).
  • Quantitative: Numerical (ALE = SLE × ARO).
• ⚠️ Exam trap: "Which is better?" → Depends on the scenario (quantitative for financial risks, qualitative for quick assessments).

Security+ Tips

• Policy Types:
• Acceptable Use Policy (AUP): Rules for employee behavior (e.g., no personal email on work devices).
• Data Retention Policy: How long data is stored and deleted (e.g., "Delete logs after 90 days").

• Incident Response Policy: Steps for detecting, responding, and recovering from breaches.

• NIST CSF Core Functions:

• Identify (Asset inventory, risk assessment).
• Protect (Firewalls, encryption, MFA).
• Detect (SIEM, IDS).
• Respond (Incident response plan).
• Recover (Backups, lessons learned).

CEH Tips

• Governance in Ethical Hacking:
• Rules of Engagement (ROE): Legal document defining what’s allowed in a penetration test (e.g., "No DoS attacks").
• Compliance Scanning: Tools like Nessus, OpenVAS check for misconfigurations (e.g., unpatched software, default passwords).

Quick Check Questions

1. A company wants to ensure its security program aligns with business objectives. Which framework is BEST suited for this?
2. A) ISO 27001
3. B) NIST CSF
4. C) COBIT

5. D) PCI DSS
   ✅ Correct Answer: C) COBIT
   Explanation: COBIT is designed to align IT with business goals, while ISO 27001 and NIST CSF focus on security controls, and PCI DSS is for payment card security.

6. During a risk assessment, a security team identifies that a web server has a vulnerability with a Single Loss Expectancy (SLE) of $50,000 and an Annualized Rate of Occurrence (ARO) of 0.5. What is the Annualized Loss Expectancy (ALE)?

7. A) $25,000
8. B) $50,000
9. C) $100,000

10. D) $250,000
    ✅ Correct Answer: A) $25,000
    Explanation: ALE = SLE × ARO → $50,000 × 0.5 = $25,000.

11. A hospital is implementing a new security policy. Which of the following is an example of a standard (not a policy, procedure, or guideline)?

12. A) "All employees must complete annual security awareness training."
13. B) "Passwords must be at least 12 characters long and include a special character."
14. C) "To reset a password, submit a ticket to the IT helpdesk."
15. D) "Using a password manager is recommended for better security."
    ✅ Correct Answer: B) "Passwords must be at least 12 characters long and include a special character."
    Explanation: A standard is a mandatory rule, while a policy is high-level, a procedure is step-by-step, and a guideline is a recommendation.

Last-Minute Cram Sheet

1. ISO 27001 = ISMS standard (Plan-Do-Check-Act, certifiable).
2. NIST CSF = 5 functions (Identify, Protect, Detect, Respond, Recover).
3. COBIT = IT governance framework (aligns IT with business).
4. Policy > Standard > Procedure > Guideline (hierarchy of rules).
5. BIA (Business Impact Analysis) = Identifies critical functions & MTD (Maximum Tolerable Downtime).
6. ALE = SLE × ARO (Annualized Loss Expectancy = Single Loss Expectancy × Annualized Rate of Occurrence).
7. Third-Party Risk Management (TPRM) = Vendor assessments (SOC 2, penetration tests).
8. Compliance ≠ Security ⚠️ (e.g., HIPAA-compliant but still vulnerable).
9. Governance = Strategic (Board), Management = Tactical (CISO, IT team).
10. Most breaches start with human error → Security awareness training is critical.

Final Advice

• For CISSP: Focus on governance vs. management and risk management formulas (ALE, SLE, ARO).
• For Security+: Memorize policy types (AUP, IRP, Data Retention) and NIST CSF functions.
• For CEH: Know Rules of Engagement (ROE) and compliance scanning tools (Nessus, OpenVAS).

Good luck on your exam! ?